EIP-2026-102402

This exploit demonstrates a stored XSS vulnerability in ManageEngine AssetExplorer 6.2.0 via the ciName or assetName parameters in a POST request to /AssetDef.do. The payload injects an img tag with an onerror event handler to execute arbitrary JavaScript.